Windows Analysis Report
Uhy4TvdjRw.exe

Overview

General Information

Sample Name: Uhy4TvdjRw.exe
Analysis ID: 679246
MD5: 10135b39a4a6d8717ba8ceec380ef060
SHA1: 3669c101670b0b373dea1c7729718340196da4bc
SHA256: 45e87ee0b025a7e4a783a6786564982e7735c8c50d0b3d84a3d5dd90ce735cfe
Tags: AsyncRATexeRAT
Infos:

Detection

AsyncRAT
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Sigma detected: Schedule system process
Antivirus / Scanner detection for submitted sample
System process connects to network (likely due to code injection or exploit)
Yara detected AsyncRAT
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
.NET source code contains potential unpacker
Yara detected Generic Downloader
Machine Learning detection for dropped file
Uses schtasks.exe or at.exe to add and modify task schedules
Drops PE files with benign system names
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Internet Provider seen in connection with other malware
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
AV process strings found (often used to terminate AV products)
Sample file is different than original file name gathered from version info
Drops PE files
Detected TCP or UDP traffic on non-standard ports
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: Uhy4TvdjRw.exe Virustotal: Detection: 67% Perma Link
Source: Uhy4TvdjRw.exe Metadefender: Detection: 57% Perma Link
Source: Uhy4TvdjRw.exe ReversingLabs: Detection: 96%
Antivirus / Scanner detection for submitted sample
Source: Uhy4TvdjRw.exe Avira: detected
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\svchost.exe Avira: detection malicious, Label: HEUR/AGEN.1202836
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\svchost.exe Virustotal: Detection: 67% Perma Link
Source: C:\Users\user\AppData\Roaming\svchost.exe Metadefender: Detection: 57% Perma Link
Source: C:\Users\user\AppData\Roaming\svchost.exe ReversingLabs: Detection: 96%
Machine Learning detection for sample
Source: Uhy4TvdjRw.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\svchost.exe Joe Sandbox ML: detected
Source: 00000000.00000002.278048476.0000000002B00000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: AsyncRAT {"Server": "127.0.0.1,61.14.233.88", "Ports": "6606,7707,8808", "Version": "0.5.7B", "Autorun": "true", "Install_Folder": "%AppData%"}
Uses 32bit PE files
Source: Uhy4TvdjRw.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Uhy4TvdjRw.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Users\user\AppData\Roaming\svchost.exe Network Connect: 61.14.233.88 7707 Jump to behavior
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2035595 ET TROJAN Generic AsyncRAT Style SSL Cert 61.14.233.88:7707 -> 192.168.2.3:49739
Source: Traffic Snort IDS: 2030673 ET TROJAN Observed Malicious SSL Cert (AsyncRAT Server) 61.14.233.88:7707 -> 192.168.2.3:49739
Yara detected Generic Downloader
Source: Yara match File source: Uhy4TvdjRw.exe, type: SAMPLE
Source: Yara match File source: 0.0.Uhy4TvdjRw.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Uhy4TvdjRw.exe.2b00314.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: VNPT-AS-VNVNPTCorpVN VNPT-AS-VNVNPTCorpVN
Detected TCP or UDP traffic on non-standard ports
Source: global traffic TCP traffic: 192.168.2.3:49739 -> 61.14.233.88:7707
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: unknown TCP traffic detected without corresponding DNS query: 61.14.233.88
Source: svchost.exe, 0000000B.00000002.534018978.0000000005100000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 0000000B.00000002.534132653.0000000005115000.00000004.00000800.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.11.dr String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Uhy4TvdjRw.exe, 00000000.00000002.278002213.0000000002AC7000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.528272233.00000000029A4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Yara detected AsyncRAT
Source: Yara match File source: Uhy4TvdjRw.exe, type: SAMPLE
Source: Yara match File source: 0.0.Uhy4TvdjRw.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Uhy4TvdjRw.exe.2b00314.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Uhy4TvdjRw.exe.2b00314.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.278048476.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.257007882.00000000006D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.528272233.00000000029A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Uhy4TvdjRw.exe PID: 2508, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: svchost.exe PID: 4152, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: Uhy4TvdjRw.exe, type: SAMPLE Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: dump.pcap, type: PCAP Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.Uhy4TvdjRw.exe.6d0000.0.unpack, type: UNPACKEDPE Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.Uhy4TvdjRw.exe.2b00314.0.unpack, type: UNPACKEDPE Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0.2.Uhy4TvdjRw.exe.2b00314.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0000000B.00000002.534018978.0000000005100000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000B.00000003.304436416.00000000051E6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.280682459.0000000004F88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000003.269514411.0000000004F88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.278048476.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000000.00000000.257007882.00000000006D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0000000B.00000002.526007263.0000000000A3A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.277813823.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 00000000.00000002.277813823.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000B.00000003.304383142.00000000051DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000A.00000002.304518771.0000000001439000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000B.00000002.528272233.00000000029A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: 0000000B.00000002.528272233.00000000029A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0000000A.00000002.305975314.0000000003341000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: Uhy4TvdjRw.exe PID: 2508, type: MEMORYSTR Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: Uhy4TvdjRw.exe PID: 2508, type: MEMORYSTR Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: svchost.exe PID: 5208, type: MEMORYSTR Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: svchost.exe PID: 4152, type: MEMORYSTR Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Source: Process Memory Space: svchost.exe PID: 4152, type: MEMORYSTR Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED Matched rule: Detects file containing reversed ASEP Autorun registry keys Author: ditekSHen
Uses 32bit PE files
Source: Uhy4TvdjRw.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: Uhy4TvdjRw.exe, type: SAMPLE Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: dump.pcap, type: PCAP Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.Uhy4TvdjRw.exe.6d0000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.Uhy4TvdjRw.exe.2b00314.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0.2.Uhy4TvdjRw.exe.2b00314.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0000000B.00000002.534018978.0000000005100000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000B.00000003.304436416.00000000051E6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.280682459.0000000004F88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000003.269514411.0000000004F88000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.278048476.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000000.00000000.257007882.00000000006D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0000000B.00000002.526007263.0000000000A3A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.277813823.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 00000000.00000002.277813823.0000000002A71000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000B.00000003.304383142.00000000051DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000A.00000002.304518771.0000000001439000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000B.00000002.528272233.00000000029A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: 0000000B.00000002.528272233.00000000029A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0000000A.00000002.305975314.0000000003341000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: Uhy4TvdjRw.exe PID: 2508, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: Uhy4TvdjRw.exe PID: 2508, type: MEMORYSTR Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: svchost.exe PID: 5208, type: MEMORYSTR Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: svchost.exe PID: 4152, type: MEMORYSTR Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Source: Process Memory Space: svchost.exe PID: 4152, type: MEMORYSTR Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED Matched rule: INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse author = ditekSHen, description = Detects file containing reversed ASEP Autorun registry keys
Detected potential crypto function
Source: C:\Users\user\AppData\Roaming\svchost.exe Code function: 11_2_04EC91C8 11_2_04EC91C8
Source: C:\Users\user\AppData\Roaming\svchost.exe Code function: 11_2_04EC9EA0 11_2_04EC9EA0
Source: C:\Users\user\AppData\Roaming\svchost.exe Code function: 11_2_04ECDB40 11_2_04ECDB40
Source: C:\Users\user\AppData\Roaming\svchost.exe Code function: 11_2_04ECF7F8 11_2_04ECF7F8
Source: C:\Users\user\AppData\Roaming\svchost.exe Code function: 11_2_04EC8E80 11_2_04EC8E80
Source: C:\Users\user\AppData\Roaming\svchost.exe Code function: 11_2_057D32D8 11_2_057D32D8
Sample file is different than original file name gathered from version info
Source: Uhy4TvdjRw.exe, 00000000.00000000.257007882.00000000006D2000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenamej% vs Uhy4TvdjRw.exe
Source: Uhy4TvdjRw.exe, 00000000.00000002.278048476.0000000002B00000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamej% vs Uhy4TvdjRw.exe
Source: Uhy4TvdjRw.exe Binary or memory string: OriginalFilenamej% vs Uhy4TvdjRw.exe
Source: Uhy4TvdjRw.exe Virustotal: Detection: 67%
Source: Uhy4TvdjRw.exe Metadefender: Detection: 57%
Source: Uhy4TvdjRw.exe ReversingLabs: Detection: 96%
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe File read: C:\Users\user\Desktop\Uhy4TvdjRw.exe Jump to behavior
Source: Uhy4TvdjRw.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Uhy4TvdjRw.exe "C:\Users\user\Desktop\Uhy4TvdjRw.exe"
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' & exit
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp93E6.tmp.bat""
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 3
Source: unknown Process created: C:\Users\user\AppData\Roaming\svchost.exe C:\Users\user\AppData\Roaming\svchost.exe
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe"
Source: C:\Windows\System32\conhost.exe Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' & exit Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp93E6.tmp.bat"" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 3 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe" Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe File created: C:\Users\user\AppData\Roaming\svchost.exe Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe File created: C:\Users\user\AppData\Local\Temp\tmp93E6.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@17/8@0/1
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: 0.0.Uhy4TvdjRw.exe.6d0000.0.unpack, FseaaQyFkS/YIdIJZaYgPiwszp.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 0.0.Uhy4TvdjRw.exe.6d0000.0.unpack, FseaaQyFkS/YIdIJZaYgPiwszp.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Uhy4TvdjRw.exe, FseaaQyFkS/YIdIJZaYgPiwszp.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: Uhy4TvdjRw.exe, FseaaQyFkS/YIdIJZaYgPiwszp.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: svchost.exe.0.dr, FseaaQyFkS/YIdIJZaYgPiwszp.cs Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: svchost.exe.0.dr, FseaaQyFkS/YIdIJZaYgPiwszp.cs Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Uhy4TvdjRw.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: Uhy4TvdjRw.exe, cIBYexWXymf/VsHHNmuqOlgyY.cs Base64 encoded string: 'rINKTV8RNDhUVTQ2UlmQxNLvun3m/IVV/oeeLlbJFNbMX3WsIpxtQwHfvqHSrqxB0pirqarn/CtEf7oWrPV+JA==', 'tKCcjiQJt2Hd++hlhtx+0yi/lZ1GNT0yK9NILXOeTmJ/r1zbNRgFr91mQbTrUbi8UZha2aMp3cP4sWtVOYvDXA==', 'ViSnkJU2TyD7eTm/mPt9N4FPgi66v7JKBBr2g1qHTGEcPnZ5xADq/6ZhMEtLRI1PceQ4kjE/pA5gWCJ2jIiiEQdMWzbE1b/ISE/DWiKMCMjnArPPaoVraLXpnepDakhVhJgaARm+GpIyBXMtpa57tm25QK1TUsycNK5fIETLwf8SDgA+OYdOU0mjjG+6D3Arflde41Heo5UAsPQXkl/68MJQciiWnCxA7GHgTK7EP02BGL/MGlPQWrqT6DO3Tp7wtQMaCHiII/L5UgbBENWkWk5+SvQTPleRGIP+IKheletffkYgkITvLKxytss1a7pGNOBAZR6gHxkr4g9G6Nr++95MAUYDctUvdvL8aMdNvDZF3UQf4OC8DAqscBqp0dbdmsfQUFVlST2dffHBIzDkwjlcXSbyLsP6351qtsy/djbnh8bcIjYLardsZFrbFaLVvZDMhqVxuvr240KxGGmqf9e17tgN5Yjhz6BDaoDFkv1vXpzFYAgdtnCcQCv7sTsWsIGJ4M+a0SLH0i9bdlA5E1w7S0AlWW96tQvL995EvEesmEHeCMtM4zeLshao24ugPhz6W7kRPiwVoUx2BTH6Qo/Bgs0GiFIBY6I1vbN4AL5LWE479S0b+ha+mTKVMMN3K7TJFS6xo30fs+WJ0SnHzBQo18AgSk9+jPqVNaSFr3G8OHb83jYq+D3r7edCCBesmgAuy2z/TNMEfhUOhnjZIAkLcy1uZoHxvoqUqL1dW3WMHCr/Lm0Y9D20u8r5keKrHmsOsXDfNdyrkDEcqJheNb2WStWclZExJNGYRgSjWSl7H9Q2DM1EBq0Z87kca6C1Y+EAf0lShvJhZYHWdk4fJYKiwnuZuOUoC32/uLzLpY6tN+LMVp231tEyjSsocb96q4D5MavacLXCqhVx3gAW3fv3l8eHE8AiPhR0js5OLKDgsoWva2qNFVF863ASInaFuBFz31UxSIHWFAcsElK/U+4frLy8HlTzP1VXU3dSfAO08uxqqdPeguvNmmPGDv3uQzeoY3+mzUx+Iu6KKEJVUe8diz9rYhPB28xPHU7sVS64bh5LX+R3ZOSpNZn/nJXUuuxvZoBOSmjMuMi67bE16mGQoX3SS2sZaNlSsTpcazv/Z6xdOVheVNPHwGDan4JfZbcS5soIgtMVUIKsmfUXjevbgoQFFlUWkUgOcFamoL/d+DBWVs2xrqiaHo6kyX4kt/rMq5Hu+XP0w0BX3XompFUVAtgyBPnkI5CGGmkiRAn4VWXMQ3e5+yg4XF05RdHp2z0Vh20Upyfu36jUpAN4qac+EUwa4j6pjz1Fqghk2lqHArzj9G14PprhVP7nW2YPG1gZ1jsTOjBVEgwtqWHAAMdWEQwvHMy5HykpeG21upiCUgDT86vZ1s1B8Vmr1R/cFsWcs+EzQAUfolK7ak0KaQv7xd2aAxuKjR5qS+0Uo152XJPLfJwDqqQyzn8vGF7dV3nmEwI82mwjD1QOJtKxX+J14SlT0MlNmCYhz2SEdb8e2I9Xv7Ea2qlvkIpvwT75OP/oJOsQxZKxb+huajW3tVpbnG6NybEC5SMXrCGxDbp1tJ1AZzjRcKfrbQ/pn3UvsZpy497nOiaYRJdugzARrGOI2+28Jw7O6KeDhdyFsLOeA4QKkhvRGt2U3ENVVOTfb3E0ewUgOKj69hJNJkaxL3h5oE+NdiuGQQ/IouUwmiaa30wjf+q2IcHkRZLfi9BNJERvRUaRCOYKktbt3+LfH0QnjxjtSDZjTPpovrBHMv1vmRy4Z0vOQ5RvNh7OzP6hipWoYCigQJVt4ciuKe/tjRpqPRBgr3w48FUlHdFvf3Uu8o/0JAz5jih5MZiCqCf2WJW7ThmhJ/XTD+JQfwCJJEQHmkR414M/ZjVhjBmSG97q5OaDB5QdAH3OzVqH7Z1j7LUC6c/xzkVf0b2m7zBckucWCMdx+ZRSdoyeKUvrKs3ShDt+LANsqi+4acNKlhZItqyFI+e2hizrnu/bLLIgmJXQb1EnmGYHcuawTDQK93sml4Ldc6uKOObo/kuX8tOHpjlNdKH/e9UHrvJJel5JjdXBS8eCAtzo0q/vF9TKX4JAf1OpC1b30hKe6T7gGVHYKUeJJXYbTcGXcDklxVUOumtZ03KJBOMcMXG++GTXj3KJvr3pUoZ3FkLe0x79Gkje8ShJWb+3OEnLS35sB/jZ8iIL5aIdQkoNNO1e16RcKmnW97Da7T8ud97UYgLW6gcjcjAPdJgJlt2X/+ANu7ohgrYAc7WsDQouQrMj/1+YVeYuo8U+CQ+TmCFK1bleNxPdsPP833f3klmIuuO9wA2J3hlVQjs2twFmaJsBaPy6414=', 'THP6gdgqES/ztFSmZNfuuRdaK9OeIa2tFJoxVdMD59uwoLhbiaBcM6BllBjS9lEiw2zMutxeOy1NImtebl7/Wl5tA2U6JjDKHsYN4gUI4qcmB3VJTHZp3A2uoQiwNflyIGzXiNpYW4U3QUsQfHtkP63bDG9GW40EB52CyAZVt8xd9nT4Svjjc9gfIlshrjJPkAYHTjg11RUi0bK8KzN37J7iZzKQNxM3luM3el0PnT6gq4nuHb7elUCFN3s/38aTeL/YEyx7b1PZlxIpKmxZiceXlCBeK16BeLe78NuqFjDqwMF8mlmJ1Ni4DpbcON/LL5CwCsmjxYxlQPYWWl8vC0BdjFfQ6/5xY6RC/UZdBhm/7RrovfU9y23+TQAzIaUafoRiZRMLQv25D6+dV7skJcEKVisSlMsHwCLN0iCzaw++ftJvPwwItCDneHWjx3iR5NeQdYHVXg/aFBe
Source: svchost.exe.0.dr, cIBYexWXymf/VsHHNmuqOlgyY.cs Base64 encoded string: 'rINKTV8RNDhUVTQ2UlmQxNLvun3m/IVV/oeeLlbJFNbMX3WsIpxtQwHfvqHSrqxB0pirqarn/CtEf7oWrPV+JA==', 'tKCcjiQJt2Hd++hlhtx+0yi/lZ1GNT0yK9NILXOeTmJ/r1zbNRgFr91mQbTrUbi8UZha2aMp3cP4sWtVOYvDXA==', 'ViSnkJU2TyD7eTm/mPt9N4FPgi66v7JKBBr2g1qHTGEcPnZ5xADq/6ZhMEtLRI1PceQ4kjE/pA5gWCJ2jIiiEQdMWzbE1b/ISE/DWiKMCMjnArPPaoVraLXpnepDakhVhJgaARm+GpIyBXMtpa57tm25QK1TUsycNK5fIETLwf8SDgA+OYdOU0mjjG+6D3Arflde41Heo5UAsPQXkl/68MJQciiWnCxA7GHgTK7EP02BGL/MGlPQWrqT6DO3Tp7wtQMaCHiII/L5UgbBENWkWk5+SvQTPleRGIP+IKheletffkYgkITvLKxytss1a7pGNOBAZR6gHxkr4g9G6Nr++95MAUYDctUvdvL8aMdNvDZF3UQf4OC8DAqscBqp0dbdmsfQUFVlST2dffHBIzDkwjlcXSbyLsP6351qtsy/djbnh8bcIjYLardsZFrbFaLVvZDMhqVxuvr240KxGGmqf9e17tgN5Yjhz6BDaoDFkv1vXpzFYAgdtnCcQCv7sTsWsIGJ4M+a0SLH0i9bdlA5E1w7S0AlWW96tQvL995EvEesmEHeCMtM4zeLshao24ugPhz6W7kRPiwVoUx2BTH6Qo/Bgs0GiFIBY6I1vbN4AL5LWE479S0b+ha+mTKVMMN3K7TJFS6xo30fs+WJ0SnHzBQo18AgSk9+jPqVNaSFr3G8OHb83jYq+D3r7edCCBesmgAuy2z/TNMEfhUOhnjZIAkLcy1uZoHxvoqUqL1dW3WMHCr/Lm0Y9D20u8r5keKrHmsOsXDfNdyrkDEcqJheNb2WStWclZExJNGYRgSjWSl7H9Q2DM1EBq0Z87kca6C1Y+EAf0lShvJhZYHWdk4fJYKiwnuZuOUoC32/uLzLpY6tN+LMVp231tEyjSsocb96q4D5MavacLXCqhVx3gAW3fv3l8eHE8AiPhR0js5OLKDgsoWva2qNFVF863ASInaFuBFz31UxSIHWFAcsElK/U+4frLy8HlTzP1VXU3dSfAO08uxqqdPeguvNmmPGDv3uQzeoY3+mzUx+Iu6KKEJVUe8diz9rYhPB28xPHU7sVS64bh5LX+R3ZOSpNZn/nJXUuuxvZoBOSmjMuMi67bE16mGQoX3SS2sZaNlSsTpcazv/Z6xdOVheVNPHwGDan4JfZbcS5soIgtMVUIKsmfUXjevbgoQFFlUWkUgOcFamoL/d+DBWVs2xrqiaHo6kyX4kt/rMq5Hu+XP0w0BX3XompFUVAtgyBPnkI5CGGmkiRAn4VWXMQ3e5+yg4XF05RdHp2z0Vh20Upyfu36jUpAN4qac+EUwa4j6pjz1Fqghk2lqHArzj9G14PprhVP7nW2YPG1gZ1jsTOjBVEgwtqWHAAMdWEQwvHMy5HykpeG21upiCUgDT86vZ1s1B8Vmr1R/cFsWcs+EzQAUfolK7ak0KaQv7xd2aAxuKjR5qS+0Uo152XJPLfJwDqqQyzn8vGF7dV3nmEwI82mwjD1QOJtKxX+J14SlT0MlNmCYhz2SEdb8e2I9Xv7Ea2qlvkIpvwT75OP/oJOsQxZKxb+huajW3tVpbnG6NybEC5SMXrCGxDbp1tJ1AZzjRcKfrbQ/pn3UvsZpy497nOiaYRJdugzARrGOI2+28Jw7O6KeDhdyFsLOeA4QKkhvRGt2U3ENVVOTfb3E0ewUgOKj69hJNJkaxL3h5oE+NdiuGQQ/IouUwmiaa30wjf+q2IcHkRZLfi9BNJERvRUaRCOYKktbt3+LfH0QnjxjtSDZjTPpovrBHMv1vmRy4Z0vOQ5RvNh7OzP6hipWoYCigQJVt4ciuKe/tjRpqPRBgr3w48FUlHdFvf3Uu8o/0JAz5jih5MZiCqCf2WJW7ThmhJ/XTD+JQfwCJJEQHmkR414M/ZjVhjBmSG97q5OaDB5QdAH3OzVqH7Z1j7LUC6c/xzkVf0b2m7zBckucWCMdx+ZRSdoyeKUvrKs3ShDt+LANsqi+4acNKlhZItqyFI+e2hizrnu/bLLIgmJXQb1EnmGYHcuawTDQK93sml4Ldc6uKOObo/kuX8tOHpjlNdKH/e9UHrvJJel5JjdXBS8eCAtzo0q/vF9TKX4JAf1OpC1b30hKe6T7gGVHYKUeJJXYbTcGXcDklxVUOumtZ03KJBOMcMXG++GTXj3KJvr3pUoZ3FkLe0x79Gkje8ShJWb+3OEnLS35sB/jZ8iIL5aIdQkoNNO1e16RcKmnW97Da7T8ud97UYgLW6gcjcjAPdJgJlt2X/+ANu7ohgrYAc7WsDQouQrMj/1+YVeYuo8U+CQ+TmCFK1bleNxPdsPP833f3klmIuuO9wA2J3hlVQjs2twFmaJsBaPy6414=', 'THP6gdgqES/ztFSmZNfuuRdaK9OeIa2tFJoxVdMD59uwoLhbiaBcM6BllBjS9lEiw2zMutxeOy1NImtebl7/Wl5tA2U6JjDKHsYN4gUI4qcmB3VJTHZp3A2uoQiwNflyIGzXiNpYW4U3QUsQfHtkP63bDG9GW40EB52CyAZVt8xd9nT4Svjjc9gfIlshrjJPkAYHTjg11RUi0bK8KzN37J7iZzKQNxM3luM3el0PnT6gq4nuHb7elUCFN3s/38aTeL/YEyx7b1PZlxIpKmxZiceXlCBeK16BeLe78NuqFjDqwMF8mlmJ1Ni4DpbcON/LL5CwCsmjxYxlQPYWWl8vC0BdjFfQ6/5xY6RC/UZdBhm/7RrovfU9y23+TQAzIaUafoRiZRMLQv25D6+dV7skJcEKVisSlMsHwCLN0iCzaw++ftJvPwwItCDneHWjx3iR5NeQdYHVXg/aFBe
Source: 0.0.Uhy4TvdjRw.exe.6d0000.0.unpack, cIBYexWXymf/VsHHNmuqOlgyY.cs Base64 encoded string: 'rINKTV8RNDhUVTQ2UlmQxNLvun3m/IVV/oeeLlbJFNbMX3WsIpxtQwHfvqHSrqxB0pirqarn/CtEf7oWrPV+JA==', 'tKCcjiQJt2Hd++hlhtx+0yi/lZ1GNT0yK9NILXOeTmJ/r1zbNRgFr91mQbTrUbi8UZha2aMp3cP4sWtVOYvDXA==', 'ViSnkJU2TyD7eTm/mPt9N4FPgi66v7JKBBr2g1qHTGEcPnZ5xADq/6ZhMEtLRI1PceQ4kjE/pA5gWCJ2jIiiEQdMWzbE1b/ISE/DWiKMCMjnArPPaoVraLXpnepDakhVhJgaARm+GpIyBXMtpa57tm25QK1TUsycNK5fIETLwf8SDgA+OYdOU0mjjG+6D3Arflde41Heo5UAsPQXkl/68MJQciiWnCxA7GHgTK7EP02BGL/MGlPQWrqT6DO3Tp7wtQMaCHiII/L5UgbBENWkWk5+SvQTPleRGIP+IKheletffkYgkITvLKxytss1a7pGNOBAZR6gHxkr4g9G6Nr++95MAUYDctUvdvL8aMdNvDZF3UQf4OC8DAqscBqp0dbdmsfQUFVlST2dffHBIzDkwjlcXSbyLsP6351qtsy/djbnh8bcIjYLardsZFrbFaLVvZDMhqVxuvr240KxGGmqf9e17tgN5Yjhz6BDaoDFkv1vXpzFYAgdtnCcQCv7sTsWsIGJ4M+a0SLH0i9bdlA5E1w7S0AlWW96tQvL995EvEesmEHeCMtM4zeLshao24ugPhz6W7kRPiwVoUx2BTH6Qo/Bgs0GiFIBY6I1vbN4AL5LWE479S0b+ha+mTKVMMN3K7TJFS6xo30fs+WJ0SnHzBQo18AgSk9+jPqVNaSFr3G8OHb83jYq+D3r7edCCBesmgAuy2z/TNMEfhUOhnjZIAkLcy1uZoHxvoqUqL1dW3WMHCr/Lm0Y9D20u8r5keKrHmsOsXDfNdyrkDEcqJheNb2WStWclZExJNGYRgSjWSl7H9Q2DM1EBq0Z87kca6C1Y+EAf0lShvJhZYHWdk4fJYKiwnuZuOUoC32/uLzLpY6tN+LMVp231tEyjSsocb96q4D5MavacLXCqhVx3gAW3fv3l8eHE8AiPhR0js5OLKDgsoWva2qNFVF863ASInaFuBFz31UxSIHWFAcsElK/U+4frLy8HlTzP1VXU3dSfAO08uxqqdPeguvNmmPGDv3uQzeoY3+mzUx+Iu6KKEJVUe8diz9rYhPB28xPHU7sVS64bh5LX+R3ZOSpNZn/nJXUuuxvZoBOSmjMuMi67bE16mGQoX3SS2sZaNlSsTpcazv/Z6xdOVheVNPHwGDan4JfZbcS5soIgtMVUIKsmfUXjevbgoQFFlUWkUgOcFamoL/d+DBWVs2xrqiaHo6kyX4kt/rMq5Hu+XP0w0BX3XompFUVAtgyBPnkI5CGGmkiRAn4VWXMQ3e5+yg4XF05RdHp2z0Vh20Upyfu36jUpAN4qac+EUwa4j6pjz1Fqghk2lqHArzj9G14PprhVP7nW2YPG1gZ1jsTOjBVEgwtqWHAAMdWEQwvHMy5HykpeG21upiCUgDT86vZ1s1B8Vmr1R/cFsWcs+EzQAUfolK7ak0KaQv7xd2aAxuKjR5qS+0Uo152XJPLfJwDqqQyzn8vGF7dV3nmEwI82mwjD1QOJtKxX+J14SlT0MlNmCYhz2SEdb8e2I9Xv7Ea2qlvkIpvwT75OP/oJOsQxZKxb+huajW3tVpbnG6NybEC5SMXrCGxDbp1tJ1AZzjRcKfrbQ/pn3UvsZpy497nOiaYRJdugzARrGOI2+28Jw7O6KeDhdyFsLOeA4QKkhvRGt2U3ENVVOTfb3E0ewUgOKj69hJNJkaxL3h5oE+NdiuGQQ/IouUwmiaa30wjf+q2IcHkRZLfi9BNJERvRUaRCOYKktbt3+LfH0QnjxjtSDZjTPpovrBHMv1vmRy4Z0vOQ5RvNh7OzP6hipWoYCigQJVt4ciuKe/tjRpqPRBgr3w48FUlHdFvf3Uu8o/0JAz5jih5MZiCqCf2WJW7ThmhJ/XTD+JQfwCJJEQHmkR414M/ZjVhjBmSG97q5OaDB5QdAH3OzVqH7Z1j7LUC6c/xzkVf0b2m7zBckucWCMdx+ZRSdoyeKUvrKs3ShDt+LANsqi+4acNKlhZItqyFI+e2hizrnu/bLLIgmJXQb1EnmGYHcuawTDQK93sml4Ldc6uKOObo/kuX8tOHpjlNdKH/e9UHrvJJel5JjdXBS8eCAtzo0q/vF9TKX4JAf1OpC1b30hKe6T7gGVHYKUeJJXYbTcGXcDklxVUOumtZ03KJBOMcMXG++GTXj3KJvr3pUoZ3FkLe0x79Gkje8ShJWb+3OEnLS35sB/jZ8iIL5aIdQkoNNO1e16RcKmnW97Da7T8ud97UYgLW6gcjcjAPdJgJlt2X/+ANu7ohgrYAc7WsDQouQrMj/1+YVeYuo8U+CQ+TmCFK1bleNxPdsPP833f3klmIuuO9wA2J3hlVQjs2twFmaJsBaPy6414=', 'THP6gdgqES/ztFSmZNfuuRdaK9OeIa2tFJoxVdMD59uwoLhbiaBcM6BllBjS9lEiw2zMutxeOy1NImtebl7/Wl5tA2U6JjDKHsYN4gUI4qcmB3VJTHZp3A2uoQiwNflyIGzXiNpYW4U3QUsQfHtkP63bDG9GW40EB52CyAZVt8xd9nT4Svjjc9gfIlshrjJPkAYHTjg11RUi0bK8KzN37J7iZzKQNxM3luM3el0PnT6gq4nuHb7elUCFN3s/38aTeL/YEyx7b1PZlxIpKmxZiceXlCBeK16BeLe78NuqFjDqwMF8mlmJ1Ni4DpbcON/LL5CwCsmjxYxlQPYWWl8vC0BdjFfQ6/5xY6RC/UZdBhm/7RrovfU9y23+TQAzIaUafoRiZRMLQv25D6+dV7skJcEKVisSlMsHwCLN0iCzaw++ftJvPwwItCDneHWjx3iR5NeQdYHVXg/aFBe
Source: C:\Users\user\AppData\Roaming\svchost.exe Mutant created: \Sessions\1\BaseNamedObjects\AsyncMutex_6SI8OkPnk
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2936:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \BaseNamedObjects\Local\SM0:4412:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6052:120:WilError_01
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp93E6.tmp.bat""
Source: C:\Users\user\AppData\Roaming\svchost.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Uhy4TvdjRw.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Uhy4TvdjRw.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: Uhy4TvdjRw.exe, IbbhSxkMmBWFzaYru/gxvoCtTjVDav.cs .Net Code: FRvoUOlAqvBX System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: svchost.exe.0.dr, IbbhSxkMmBWFzaYru/gxvoCtTjVDav.cs .Net Code: FRvoUOlAqvBX System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.Uhy4TvdjRw.exe.6d0000.0.unpack, IbbhSxkMmBWFzaYru/gxvoCtTjVDav.cs .Net Code: FRvoUOlAqvBX System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

Persistence and Installation Behavior
barindex
Drops PE files with benign system names
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe File created: C:\Users\user\AppData\Roaming\svchost.exe Jump to dropped file
Drops PE files
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe File created: C:\Users\user\AppData\Roaming\svchost.exe Jump to dropped file

Boot Survival
barindex
Yara detected AsyncRAT
Source: Yara match File source: Uhy4TvdjRw.exe, type: SAMPLE
Source: Yara match File source: 0.0.Uhy4TvdjRw.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Uhy4TvdjRw.exe.2b00314.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Uhy4TvdjRw.exe.2b00314.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.278048476.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.257007882.00000000006D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.528272233.00000000029A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Uhy4TvdjRw.exe PID: 2508, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: svchost.exe PID: 4152, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"'
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\AppData\Roaming\svchost.exe Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AsyncRAT
Source: Yara match File source: Uhy4TvdjRw.exe, type: SAMPLE
Source: Yara match File source: 0.0.Uhy4TvdjRw.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Uhy4TvdjRw.exe.2b00314.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Uhy4TvdjRw.exe.2b00314.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.278048476.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.257007882.00000000006D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.528272233.00000000029A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Uhy4TvdjRw.exe PID: 2508, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: svchost.exe PID: 4152, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Uhy4TvdjRw.exe, svchost.exe.0.dr Binary or memory string: SBIEDLL.DLL
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe TID: 1112 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe TID: 5216 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe TID: 4780 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe TID: 6064 Thread sleep time: -5534023222112862s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe TID: 6064 Thread sleep count: 95 > 30 Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe TID: 2244 Thread sleep count: 9799 > 30 Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\AppData\Roaming\svchost.exe Window / User API: threadDelayed 9799 Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe File Volume queried: C:\ FullSizeInformation Jump to behavior
Source: svchost.exe.0.dr Binary or memory string: vmware
Source: svchost.exe, 0000000B.00000003.304436416.00000000051E6000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW(
Enables debug privileges
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Users\user\AppData\Roaming\svchost.exe Network Connect: 61.14.233.88 7707 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' & exit Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\tmp93E6.tmp.bat"" Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\user\AppData\Roaming\svchost.exe"' Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\timeout.exe timeout 3 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Users\user\AppData\Roaming\svchost.exe "C:\Users\user\AppData\Roaming\svchost.exe" Jump to behavior
Source: svchost.exe, 0000000B.00000002.528588986.00000000029FA000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000B.00000003.306525634.0000000005801000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000B.00000002.528776831.0000000002A38000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Program Manager
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Queries volume information: C:\Users\user\Desktop\Uhy4TvdjRw.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Queries volume information: C:\Users\user\AppData\Roaming\svchost.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Queries volume information: C:\Users\user\AppData\Roaming\svchost.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\svchost.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Uhy4TvdjRw.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Yara detected AsyncRAT
Source: Yara match File source: Uhy4TvdjRw.exe, type: SAMPLE
Source: Yara match File source: 0.0.Uhy4TvdjRw.exe.6d0000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Uhy4TvdjRw.exe.2b00314.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.Uhy4TvdjRw.exe.2b00314.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.278048476.0000000002B00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.257007882.00000000006D2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.528272233.00000000029A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Uhy4TvdjRw.exe PID: 2508, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: svchost.exe PID: 4152, type: MEMORYSTR
Source: Yara match File source: C:\Users\user\AppData\Roaming\svchost.exe, type: DROPPED
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Source: C:\Windows\System32\conhost.exe WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\conhost.exe WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\conhost.exe WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\conhost.exe WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct
Source: C:\Users\user\AppData\Roaming\svchost.exe WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
AV process strings found (often used to terminate AV products)
Source: svchost.exe, 0000000B.00000002.534132653.0000000005115000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 679246 Sample: Uhy4TvdjRw.exe Startdate: 05/08/2022 Architecture: WINDOWS Score: 100 44 Snort IDS alert for network traffic 2->44 46 Malicious sample detected (through community Yara rule) 2->46 48 Antivirus / Scanner detection for submitted sample 2->48 50 7 other signatures 2->50 9 Uhy4TvdjRw.exe 7 2->9         started        13 svchost.exe 3 2->13         started        process3 file4 36 C:\Users\user\AppData\Roaming\svchost.exe, PE32 9->36 dropped 38 C:\Users\user\AppData\...\Uhy4TvdjRw.exe.log, ASCII 9->38 dropped 54 Drops PE files with benign system names 9->54 15 cmd.exe 1 9->15         started        17 cmd.exe 1 9->17         started        56 Antivirus detection for dropped file 13->56 58 Multi AV Scanner detection for dropped file 13->58 60 Machine Learning detection for dropped file 13->60 signatures5 process6 signatures7 20 svchost.exe 2 15->20         started        24 conhost.exe 15->24         started        26 timeout.exe 1 15->26         started        42 Uses schtasks.exe or at.exe to add and modify task schedules 17->42 28 conhost.exe 17->28         started        30 schtasks.exe 1 17->30         started        process8 dnsIp9 40 61.14.233.88, 49739, 7707 VNPT-AS-VNVNPTCorpVN Viet Nam 20->40 52 System process connects to network (likely due to code injection or exploit) 20->52 32 MpCmdRun.exe 1 28->32         started        signatures10 process11 process12 34 conhost.exe 32->34         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
61.14.233.88
 unknown Viet Nam
45899 VNPT-AS-VNVNPTCorpVN true

Contacted Domains

Name IP Active
windowsupdatebg.s.llnwi.net 95.140.230.192 true